Morning Brief: Monday, November 9

Seventy-six feeds reporting. Two weeks. 5,352 items reduced to what follows. (what we track, how we crawl, subscribe)

Monday is the day agent containment stopped being a research topic and became a product category. CrowdStrike is selling a kill switch, Palo Alto is paying $500M for a startup that does it, Google handed gVisor to the CNCF, and regulators told enterprises the liability is theirs regardless.

The leash it clamps onto is made of memory, and that is the part worth sitting with. AWS's pitch for Kiro bots is agent memory as the mechanism that removes the human from the loop; Perplexity's agents now outlive the browser tab. The same week, arXiv shipped MemoryDojo on poisoning through agent memory, The Memory Trap on agents overgeneralizing from benign interactions, and MCPHallu on memory hallucination in MCP agents. The thing being sold as the mechanism of delegation and the thing being benchmarked as the newest attack surface are the same object, and the vendors and the papers are not reading each other.

Asahi Linux is the week's one concrete governance action rather than a product or a benchmark. The project relicensed from MIT to GPL after finding LLM-assisted license laundering in contributions — a maintainer response to provenance loss, taken at the license layer, where it is enforceable. Read it beside Logit Laundering on evading data-use auditing and Analyzing Code Provenance in LLMs, which describe the same failure from the measurement side.

Top (5-7 min)

Can CrowdStrike's new AI kill switch shut down rogue AI agents?: Slashdot, 2026-11-09. Containment sold as an endpoint feature. Start here; the question mark in the headline is the whole brief.
Why Google's giving away gVisor, a code sandbox used by Anthropic and OpenAI: The New Stack, 2026-11-06. The sandbox two frontier labs already run on, donated to a foundation. Infrastructure moves become standards this way.
Enterprises must take blame for their AI agents' mistakes, say regulators: InfoWorld, 2026-11-06. Liability lands on the deployer, not the model vendor. This is why the containment market exists at all.
Asahi Linux drops MIT and goes full GPL after spotting LLM-assisted license laundering: Slashdot, 2026-11-09. A project changing its license in response to machine-generated provenance loss. The week's only enforceable action.
MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory: arXiv cs.AI, 2026-11-09. Agent memory as attack surface, benchmarked. Read against AWS's product pitch below, which treats the same memory as the solution.
Why AWS wants developers to stop babysitting their AI agents: The New Stack, 2026-11-07. Memory as the mechanism for removing the human from the loop. The product end of the thread.
CPython flaw exposes AI inference servers to sandbox escape attacks: InfoWorld, 2026-11-06. A concrete escape in the layer everyone is now buying. The gVisor donation and this advisory are the same week.

Themes

Containment as a product category

Four separate commercial moves in one week, which is unusual timing for an area that was conference-paper material in the spring. The kill switch and the acquisition are the demand side; the gVisor donation is the supply side, and the regulators' statement is why anyone is paying. The CPython advisory is the reminder that the layer being sold has holes in it.

Palo Alto Networks in talks to buy AI agent security startup Clutch for $500M: TechCrunch, 2026-11-06. Half a billion for agent identity and containment. Price as a measure of how real the category is.
Claude Code's "Don't Ask Again" file exposes passwords and keys in 1,122 public copies on GitHub: Slashdot, 2026-11-08. Permission state committed to public repos. The containment config is itself a leak surface.
Trust Responsive Runtime Authorization for Agentic AI: arXiv cs.AI, 2026-11-06. Runtime authorization with policy sensitivity measured rather than asserted. The research version of what Clutch sells.
Knowing When to Intervene: Causal Evaluation of AI Agents: arXiv cs.AI, 2026-11-09. The intervention question posed causally. A kill switch needs a trigger condition and this is the attempt to define one.
Aligning, Fast and Slow: A Control-Theoretic Oversight Framework for Long-Horizon Trajectories: arXiv cs.AI, 2026-11-09. Oversight as a control problem over long deployments, not a per-call check.
On Agentic Manipulation Policies: arXiv cs.AI, 2026-11-09. What the contained thing does when it has an incentive to not be contained.
What to Delegate, What to Preserve: Human Preferences for Agentic AI Across Everyday Life and Work: arXiv cs.AI, 2026-11-09. The demand-side survey. Useful counterweight to vendors deciding the delegation boundary for you.
How components can help us govern agents: InfoWorld, 2026-11-09. Governance via component boundaries. Architectural answer to the same question the kill switch answers operationally.

Delegation is memory

The mechanism every "stop babysitting your agents" product reaches for is persistent memory, and it is the week's densest arXiv cluster: six papers on building it, three on breaking it. Nobody is citing across the gap.

Perplexity's AI agents keep working after you close the tab: The New Stack, 2026-11-08. Persistence past the session. The product form of a long leash.
AI agents are getting more complex. Developers shouldn't have to babysit them.: The New Stack, 2026-11-06. Harness making the same pitch as AWS in the same week. The pitch is now the category's default framing.
ENGRAM: From Agent Experience to Weights through Verified Consolidation: arXiv cs.AI, 2026-11-09. Experience consolidated into weights with a verification step. The most ambitious version of the memory idea this cycle.
Decision Context: Persistent Behavioral Learning for AI Agents: arXiv cs.AI, 2026-11-09. Behavioral learning that survives the session, which is exactly what Perplexity shipped.
The Memory Trap: Language Agents Overgeneralize from Benign Interactions: arXiv cs.AI, 2026-11-06. No attacker required. Benign history is enough to produce the wrong generalization.
MCPHallu: Benchmarking Reasoning, Execution, and Memory Hallucinations in MCP Agents: arXiv cs.AI, 2026-11-06. Memory hallucination measured separately from reasoning hallucination, which is the distinction tool authors need.
Jacobian-Causal Memory Control for Persistent Memory in Language Model Systems: arXiv cs.AI, 2026-11-09. Control-theoretic handle on what persistent memory is allowed to change.
How Much Conversation History Does an AI Agent Need?: arXiv cs.AI, 2026-11-09. The empirical question under all of the above. Less than you are storing, per the result.
Rethinking Agent Trajectory Compression: A Workflow-Aware Perspective: arXiv cs.AI, 2026-11-09. Compression that knows what the workflow was. Read with the conversation-history paper.
Enhancing Local and Global Structure in Compressed AI Agent Memory: arXiv cs.AI, 2026-11-06. Structure preservation under compression, from the other direction.
When Instruction Files Go Stale: Documentation Debt and Hidden Cost in Coding Agents: arXiv cs.AI, 2026-11-09. Stale AGENTS.md as a measured cost. Directly applicable if you maintain one.

Provenance, and one project acting on it

Asahi's relicensing is the week's only governance action with teeth. Everything else here measures the problem.

Logit Laundering: Evading Data-Use Auditing in Large Language Models: arXiv cs.AI, 2026-11-09. Data-use audits defeated at the logit layer. The measurement side of what Asahi found in its commit history.
Analyzing Code Provenance in LLMs for Programming Education: arXiv cs.AI, 2026-11-09. Provenance attribution attempted on generated code. The tooling Asahi did not have.
Progress Report: Linux 7.3: Asahi Linux, 2026-11-07. The project's own report, from before the license news broke.
Hide your slop PR descriptions behind <details><summary>: Simon Willison, 2026-11-09. A social convention for marking machine-written text in review. The low-tech end of the provenance problem.
How we review 4x more AI code without reading every line: The New Stack, 2026-11-07. A shop that scaled review by not reading. Honest about the tradeoff, which is rarer than it should be.
Who wants to crowdsource LLM scans of articles submitted to Lobste.rs?: Lobsters, 2026-11-08. A community deciding whether to detect generated submissions. Same problem one layer up.
Workflow dependency lockfiles: GitHub Docs, 2026-11-07. Provenance pinning at the supply-chain layer. Shipped, not proposed.

Scan

The crawler zoo

The zoo's week-45 report is 53,937 requests, and the new arrivals have a shape: readiness scanners, MCP directory probes, and icon fetchers on behalf of orchestrators. The agent buildout is visible in other people's access logs before it is visible anywhere else.

Zoo Report, Week 45, 2026: 53,937 bot requests: The Crawler Zoo, 2026-11-09.
AgentReadinessScanner: The Crawler Zoo, 2026-11-09.
agent-orchestrator-icon-fetch: The Crawler Zoo, 2026-11-09.
AllMCPsBot: The Crawler Zoo, 2026-11-08.
mcp-directory-check: The Crawler Zoo, 2026-11-07.
mcp-icon-survey: The Crawler Zoo, 2026-11-06.
TaskPrepProbeBot: The Crawler Zoo, 2026-11-08.
bots.st-checker: The Crawler Zoo, 2026-11-07.
ads-well-known-bot: The Crawler Zoo, 2026-11-06.
bounded-public-fetch: The Crawler Zoo, 2026-11-06.
hn-corpus-experiment: The Crawler Zoo, 2026-11-08.
DomainRiskBot: The Crawler Zoo, 2026-11-06.
heritrix: The Crawler Zoo, 2026-11-08.

Boston

The Boston AI Summit 2027: Boston AI Week, 2026-11-06.
The AI in Massachusetts Workforce Development and Career Fair 2027: Boston AI Week, 2026-11-06.
Boston Generative AI Meetup at Boston AI Week 2027: Boston AI Week, 2026-11-06.
DECODING:ENCODING, with Dana Cuff and Emmanuel Proussaloglou: MIT, 2026-11-09.
Navigating Graduate School vs. Industry Panel: MIT, 2026-11-09.
2026 AIChE Annual Conference CHME Reception: Northeastern, 2026-11-09.
The GOP redrew House districts across the South to save Republican seats. Their plan failed, and succeeded.: WBUR, 2026-11-09.
Plymouth woman IDs herself in 1974 image from famed Boston photographer: WBUR, 2026-11-09.

Tail

The Port That Does Not Exist: Lobsters, 2026-11-06.
A bit about email: Lobsters, 2026-11-08.
UploadYourRam.org: Lobsters, 2026-11-06.
FAA phases out floppy disks from air traffic control: Slashdot, 2026-11-06.
The Web Is More Than Enough, by Paul Ford: Simon Willison, 2026-11-09.
Terry Pratchett's Study: Simon Willison, 2026-11-07.
The Forth Methodology of Charles Moore: Jeff Fox, 2026-11-09.
Review: elements of a Forth system (Gforth Manual): Gforth, 2026-11-09.
bombadil-labs/hermetic: GitHub, 2026-11-08.

Feed silences and verification

One hundred eighteen feeds polled at 11:00Z. Forty-eight returned new content, sixty-nine returned 304 Not Modified, and one errored: James Bornholt's www.bornholt.dev does not resolve. That is now 167 consecutive polls with zero successes, which makes it a dead feed rather than a quiet one, and it should come out of the registry.

The distinction matters because several feeds look dead and are not. Andy Wingo, Brendan Gregg, Lambda the Ultimate, Julia Evans, Lilian Weng, and Eugene Yan all returned healthy 304 responses today; they simply have not published inside the window. A 304 is a working feed behind a quiet author. An unresolvable host is neither.

All 220 URLs in this brief came from data/warehouse.db. Nothing was constructed from a title. Every one was verified through crawler/fetch-gated, which runs the blocklist, then robots.txt, then the throttle, and issues no request when the gate denies. Verification took eight and a half minutes for 220 URLs parallelized by host, and arXiv's Crawl-delay: 15 accounts for most of it: 33 of the links are arXiv abstracts, serialized on one host by design.

Results: 213 returned 200. Three were denied by robots.txt and are published anyway on feed provenance, since being told not to fetch a page is not evidence the page is gone: neongd.com and two lobste.rs threads. Four returned 403 to our user agent, which for lwn.net (subscriber-only), openai.com (two links), and thereader.mitpress.mit.edu is bot-challenge behavior rather than a broken link. One host, x86.cx, rejects HEAD with 405 and answered 200 to a GET. No link returned 404.

One link is published unverified. www.datadoghq.com resolves to 0.0.0.0 from this host, so the connection is refused locally before it leaves the network — a DNS sinkhole on our side, not a dead page. The URL came from the Lobsters feed and is almost certainly fine for readers, but we could not confirm it, so it is disclosed here rather than quietly included.

Six items in the brief carry wal.sh research as their warehouse source rather than their publisher. Those are Slashdot URLs that our own Atom feed republished; because url is the primary key, the later crawl of our feed overwrote the source field. They are attributed above to Slashdot, which is where they came from. The fix belongs in the store, not in the brief.

Two candidate links were dropped as duplicates before verification: LWN's coverage of the Amutable Foundations overview and of the Asahi 7.3 progress report, both of which we are already linking at the primary source.

Build provenance

build: 2026-11-09 | crawler-sha: b277e41 (Walsh-Research/1.2, compliance v1.4) | feeds: 118 polled today (48 ok, 69 not-modified, 1 error), 76 publishing in window | items-considered: 5352 (14d, incl. 3103 arXiv cs.AI) | warehouse: 68603 items (3602 dateless, see feed silences) | published: 220 URLs (217 allowed by gate, 3 robots-denied and kept on feed provenance; 213 HTTP 200, 4 bot-challenge 403 disclosed, 1 HEAD-405/GET-200, 1 locally sinkholed and disclosed unverified; 0 HTTP 404, 0 dead links found) | atom: 220 entries, RFC 4287 valid